By 2026, embedded artificial intelligence is present in every major workflow of a large financial institution. It scores credit applications. It prices derivatives. It triggers anti-money-laundering alerts. It drafts client communications. It feeds oracle inputs to smart contracts. It summarises supervisory examinations for senior management. The volume of decisions touched by an AI routine, directly or indirectly, has crossed the threshold at which model-risk governance can no longer be applied selectively.
Three regimes now apply. In the United States, Federal Reserve Supervisory Letter 11-7, supplemented by Office of the Comptroller of the Currency Bulletin 2011-12, defines the model-risk-management lifecycle for banks subject to enhanced prudential standards. In Canada, Office of the Superintendent of Financial Institutions Guideline E-23 sets equivalent expectations across federally regulated financial institutions, with explicit incorporation of advanced analytics and AI techniques in the 2024 revision. In the European Union, Regulation 2024/1689, the AI Act, establishes a risk-tier framework, with creditworthiness scoring and certain biometric uses classified as high-risk under Annex III.
The three regimes converge on five operational requirements. An institution must maintain a comprehensive model inventory. Each model must undergo independent validation before deployment. Performance must be monitored on an ongoing basis. Material changes must be controlled. Human oversight must be designed and evidenced at the use-case level. Institutions that have built a single model-inventory infrastructure addressing all five satisfy each regime from one source. Institutions that have built three parallel inventories struggle to reconcile them.
The definition of a model is the first reconciliation point. SR 11-7 defines a model as a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories, techniques and assumptions to process input data into quantitative estimates. OSFI E-23 broadens this to include advanced analytics and AI. The EU AI Act addresses AI systems, defined as machine-based systems designed to operate with varying levels of autonomy that infer how to generate outputs. The intersection is broad and includes any AI routine that produces a number, a classification or a generated text used in a decision or external communication.
Inventory granularity is the second reconciliation point. SR 11-7 expects every model to be uniquely identifiable, with a documented owner, a documented use, a validation status and a risk tier. The EU AI Act Annex IV technical documentation requirements for high-risk systems include description of intended purpose, persons or groups of persons affected, hardware and software resources, training data and validation results. A unified inventory record satisfies both, provided it captures the fields each regime requires.
Validation is the third reconciliation point. SR 11-7 requires effective challenge by parties independent of model development and use. OSFI E-23 specifies independent review proportionate to model risk. The EU AI Act requires conformity assessment for high-risk systems prior to market placement, with post-market monitoring and corrective action plans. A model that has passed an SR 11-7 effective challenge has typically generated the documentation required for EU AI Act conformity, although the assessment must be re-expressed in the AI Act's risk-management-system vocabulary.
Ongoing monitoring is the fourth. SR 11-7 requires performance monitoring and benchmarking, including outcome analysis, sensitivity testing and stability testing. The EU AI Act post-market monitoring obligation requires providers to collect, document and analyse data on the performance of high-risk systems throughout their lifetime, with reporting of serious incidents to the relevant national competent authority. The monitoring datasets overlap. The reporting destinations differ.
Human oversight is the fifth. The EU AI Act Article 14 sets explicit human-oversight requirements for high-risk systems, distinguishing oversight by natural persons during use from oversight built into the system design. SR 11-7 addresses human override and challenge implicitly through governance and use controls. Institutions need to designate, at the use-case level, whether the deployment is human-in-the-loop, where a human approves each output, human-on-the-loop, where a human supervises a stream of outputs, or human-out-of-the-loop, which is permitted only for limited residual uses and requires elevated controls.
Smart-contract pricers, screeners and oracles inherit the framework without modification. A pricer that runs as a chain-deployed routine is a model. An oracle feed that aggregates external data and produces an input used in pricing or eligibility is a model component. A sanctions screener invoked from a smart contract is a model. The institution that relies on these routines owes the full SR 11-7, OSFI E-23 and where applicable EU AI Act lifecycle. The chain location does not reduce the obligation.
Generative AI components require additional treatment. The EU AI Act general-purpose AI rules, Title VIII, impose obligations on providers of general-purpose AI models including technical documentation, copyright compliance and a public summary of training data. Institutions that deploy generative AI in client-facing or decision-supporting roles must document the provenance of the underlying foundation model, the fine-tuning data, the evaluation methodology and the post-deployment monitoring. The institution remains the deployer and the accountable party regardless of the supplier.
Vendor-supplied models are not exempt. SR 11-7 explicitly addresses vendor models and requires the institution to perform validation, monitor performance and understand the model's limitations even when the institution does not own the source code. The EU AI Act distinguishes provider and deployer obligations but assigns substantial responsibility to deployers, including the obligation to use the system in accordance with instructions, to monitor operation, and to inform the provider of risks identified in use. The vendor relationship does not transfer accountability.
The board-level question is whether the institution holds a single model inventory addressing all three regimes, with named accountable executives for inventory, validation, monitoring and human oversight, and with a quarterly board report that surfaces residual model risk in aggregate and at the high-risk-use-case level. Where the answer is fragmented inventories or where the inventory does not yet include generative AI components in client-facing or decision-supporting roles, the institution is not yet in a defensible posture.
Cabier Consulting's 2026 brief sets out a unified model-risk template aligned to SR 11-7, OSFI E-23 and the EU AI Act, with the inventory fields, validation evidence requirements and human-oversight designations expressed in a single schema. The institutions that have adopted the template are presenting one inventory to three regulators. The institutions that have not are presenting three inventories that do not match each other.
Generative AI deployment in client-facing roles, including conversational interfaces, document drafting and summarisation of supervisory or legal content, has surfaced the human-oversight question in a new form. Where the AI output is rendered to a customer or counterparty, the institution remains accountable for the accuracy of the communication. Disclaimers do not transfer accountability. The institution must design the workflow so that human review occurs at the right point, with the right evidence retained.
Bias and fairness testing requirements are converging. The EU AI Act Article 10 requires high-risk AI systems to be developed on the basis of training, validation and testing datasets that meet quality criteria, including being relevant, sufficiently representative and free of errors. SR 11-7 and OSFI E-23 expectations on representativeness of training data follow the same logic. The Equal Credit Opportunity Act and the Fair Housing Act add substantive fairness obligations. The institution that does not perform documented bias and fairness testing at deployment and on an ongoing basis is exposed across multiple regimes simultaneously.
Explainability requirements are calibrated to the use case. The EU AI Act Article 13 requires high-risk AI systems to be designed for sufficient transparency to enable deployers to interpret a system's output and use it appropriately. SR 11-7 requires conceptual soundness, which implies a level of explainability appropriate to the model's role. The institution must document, per use case, what level of explainability is required, how it is achieved and how it is communicated to the persons relying on the output.
Concept drift and data drift are the principal ongoing-monitoring concerns. A model that performed within tolerance at deployment can degrade as the underlying distribution of inputs changes. The institution's monitoring framework must detect drift, trigger investigation, and where necessary initiate retraining or decommissioning. The frequency of drift assessment should be proportionate to the model's role and the volatility of its inputs. For high-risk systems under the EU AI Act, the post-market monitoring plan must specify these procedures explicitly.
Decommissioning is the final stage of the lifecycle and the most frequently neglected. A model that has been replaced must be retired through a documented procedure that preserves audit evidence, terminates production access, and confirms that downstream consumers have migrated. The institution that allows decommissioned models to remain accessible in production environments retains the residual operational and supervisory risk associated with them. The decommissioning record is itself an audit artefact.
Model risk in agentic AI workflows is the 2026 frontier. An agentic system that plans, acts, observes and replans across multiple tools and external services is, from a model-risk perspective, a composite system. Each component model is in scope. The orchestration logic itself is a model. The institution must inventory the composition, document the decision rights at each step, and design human oversight at the points where the agent acts on external systems. Where the agent transacts, settles or communicates to a counterparty, the human-on-the-loop expectation tightens.
Foundation-model evaluations should be performed at the institution level rather than relying solely on supplier-provided benchmarks. Benchmarks published by foundation-model suppliers establish general capability. They do not establish suitability for a specific institutional use case. The institution that runs use-case-specific evaluation suites, with reference datasets representative of its own population, captures the residual risk that supplier benchmarks miss. The evaluations should be repeated on a defined cadence and after any material upgrade.
Model documentation must be readable by the persons accountable. SR 11-7 documentation that only the model developers can read fails the effective-challenge test. EU AI Act technical documentation that only the supplier can interpret fails the deployer-obligation test. The institution must ensure that model documentation is written for the audiences that need to use it, including the second line, internal audit, external audit and the supervisor.
Incident response for model failures is the most frequently absent capability. When a deployed model produces a materially incorrect output, the institution must be able to identify the affected decisions, communicate to affected parties, remediate the underlying cause, document the event and report to the relevant supervisors. The incident-response procedure should be exercised, not only documented. Institutions that have not exercised a model-incident response are, in practice, not ready for one.
Cross-border deployment of AI systems requires reconciliation of differing legal regimes that may apply simultaneously. A model deployed by a European subsidiary of a North American bank is subject to the EU AI Act in the territory of deployment and to SR 11-7 or OSFI E-23 at the consolidated group level. The institution must design the model lifecycle to satisfy each regime in its territorial scope and to evidence the alignment to group risk management at the parent.
Sustainability and energy implications of AI workloads, while not the primary focus of model-risk regimes, are increasingly relevant to corporate disclosure under the Corporate Sustainability Reporting Directive and to investor expectations. The institution should track and disclose the energy intensity of its AI workloads as part of its broader environmental reporting, with controls to ensure the accuracy of the disclosed metrics.
Board questions to ask now.
Has the management body received, within the last twelve months, an independent report on the control plane that addresses this asset class or capability, with named accountable executives, residual risks and a remediation timetable? Has the institution validated that its evidence file would survive a supervisor's read-through without external assistance? Has the third line of defence, internal audit, performed independent testing of the controls at the granularity the regime requires?
Operating model implications.
The capability described above is an institutional layer, not a vendor product. It must be owned by a named function, resourced at a level proportionate to the institution's exposure, and integrated with the first and second lines of defence under clear escalation paths. Where the function is matrixed across business lines, an accountable executive in the second line must hold the consolidated view.
Twelve-month implementation plan.
In the first quarter, complete the inventory of in-scope positions, processes or models, and confirm coverage against the applicable regime. In the second quarter, close the data-integration gaps and stand up the evidence file. In the third quarter, perform an independent third-line review and remediate the priority findings. In the fourth quarter, present the resulting residual-risk view to the board, set the impact tolerances and the risk appetite, and publish the operating standard for ongoing oversight.
Cabier Consulting's 2026 institutional brief, Governance Above the Rail, sets the architectural context within which the obligations discussed here are best understood. Reciprocal reading at https://cabierconsulting.com/insights/governance-above-the-rail-2026 is recommended for institutions building their control plane.